Troubleshooting JSON to Configure Sources

Sources supplied via a JSON file may not be applied to a Collector for a few reasons. This document covers common issues with JSON files when trying to configure Sources.

Before investigating your JSON file for issues check that you are using your method for managing Sources correctly. If you are using syncSources for Local Configuration File Management or the Collector API to manage Sources review your steps for issues related to using the method. For example, if your Collector isn't configured to use Local Configuration File Management it won't monitor your JSON file.

UTF-8 encoded

Verify the encoding of your JSON file is UTF-8 encoded following RFC 8259. If your JSON file is a different encoding, such as UTF-16, the Collector will be unable to read the contents of the file.

Valid JSON

If the JSON is not valid the Collector will fail to read the contents of the file. If there are any formatting issues in the JSON file you may see the following log message in the Collector logs. Installed Collectors store log events in its installation directory under the '/logs' directory. The following error message may be presented in the /logs/collector.log file.

com.sumologic.scala.collector.auth.UpdateFailedException: * Could not synchronize blade, failed to read the content of the json file

To help verify the format of your JSON you can copy and paste the content into a JSON validation tool such as jsonlint.com. jsonlint.com will highlight any potential formatting errors such as missing commas, quotes, curly braces, brackets, etc.

Valid Source configuration

Sumo Logic requires certain key/values be present in your JSON file for each Source. If the value supplied for a required key (parameter) is not in the proper casing or the proper data type the Collector will fail to read and apply the Source configuration. A few common problems which may prevent a JSON Source from being applied are:

Duplicate source names

Check that your JSON file does not contain a duplicate Source "name" as duplicate names are not permitted. The following error message may be presented in the /logs/collector.log file.

If a required key (parameter) is misspelled or not in the proper camel casing the Collector will fail to read and apply the Source configuration. For example, if you have supplied a key name of "sourcetype" instead of "sourceType". When an invalid key has been supplied you may see the following type of error message presented in the /logs/collector.log file.

If the value supplied for a required key (parameter) is misspelled, not in the proper casing, or not the proper data type the Collector will fail to read and apply the Source configuration. For example, if the value for the "sourceType" key has been supplied as "localfile" instead of "LocalFile." When an invalid value is found for a required key you may see the following type of error message presented in the /logs/collector.log file.

A Collector can have one Source that uses a specific port and protocol combination. If you have multiple Syslog or Metric Sources that specify the same port and protocol you may see the following type of error message presented in the /logs/collector.log file.

Use multiple UTF-8 encoded JSON files to specify your Sources, and put all of those files in a single folder. You can put each Source definition in its own file, or define multiple sources per file if you like.

Recommended articles

Sumo Logic is the industry’s leading secure, cloud-native, machine data analytics service, delivering real-time, continuous intelligence across the entire application lifecycle and stack. More than 1,000 customers around the globe rely on Sumo Logic for the analytics and insights to build, run and secure their modern applications and cloud infrastructures.